libheif Heap Buffer OOB Read Vulnerability Analysis (GHSA-hg7q-rj2-8x46) and Patch

Heap Buffer Out-of-Bounds Read Vulnerability Summary Vulnerability Overview Vulnerability Name: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride CVE/Advisory Number: GHSA-hg7q-rj2-8x46 Severity: High (CVSS v3 base metrics: 7.1 / 10) Description: In the file of , the function incorrectly uses the color channel stride ( ) instead of the alpha channel stride ( ) when accessing the alpha channel during the compositing of overlaid images with alpha blending. This can lead to a heap buffer out-of-bounds read of up to 3,123 bytes, potentially causing a denial of service (crash) or leaking embedded heap data via decoded output pixels. Affected Scope Affected Versions: <= 1.21.2 Fixed Version: v1.22.0 Affected Applications: Any application using to decode HEIF/AVIF files containing overlaid ( ) image items. This includes image viewers, web browsers, thumbnail generators, and any software processing untrusted HEIF files. Remediation Fixed Version: Upgrade to v1.22.0 or later. POC Code 1. Building libheif with AddressSanitizer ```bash git clone https://github.com/strukturag/libheif.git && cd libheif mkdir build && cd build cmake .. -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \ -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \ -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined" \ -DCMAKE_SHARED_LINKER_FLAGS="-fsanitize=address,undefined" \ --preset=release \ -DWITH_JPEG=ON -DWITH_JPEGXL=ON -DWITH_AOM=ON -DWITH_DAV1D=ON -DWITH_X265=ON \ -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON \ -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON \ -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON \ -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON \ -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON \ -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON \ -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON \ -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON \ -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON \ -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON \ -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON \ -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON \ -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON \ -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON \ -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON \ -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON \ -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON \ -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON \ -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON \ -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON \ -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON \ -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON \ -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON \ -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON \ -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON \ -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON \ -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON \ -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON \ -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON \ -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON \ -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON \ -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON \ -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON \ -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON \ -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON \ -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON \ -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON \ -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON \ -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON \ -DWITH_GIF=ON -DWITH_TIFF=ON -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON \ -DWITH_SVT=ON -DWITH_KDU=ON -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON \ -DWITH_X265=ON -DWITH_JPEGXL=ON -DWITH_JPEG=ON -DWITH_GIF=ON -DWITH_TIFF=ON \ -DWITH_WEBP=ON -DWITH_OPENJPEG=ON -DWITH_RAV1E=ON -DWITH_SVT=ON -DWITH_KDU=ON \ -DWITH_OPENCL=ON -DWITH_DAV1D=ON -DWITH_AOM=ON -DWITH_X265=O

Goal Reached Thanks to every supporter — we hit 100%!

libheif Heap Buffer OOB Read Vulnerability Analysis (GHSA-hg7q-rj2-8x46) and Patch

More from this source